Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Live Security Platinum (https://www.trojaner-board.de/119911-live-security-platinum.html)

Takate 19.07.2012 19:47
Live Security Platinum
 
Hallo Wissende,

mich hat (auch) der Live Security Platinum befallen. Bin (eigentlich) ein vorsichtiger User und kanns mir nicht erklären.

Hier ist der Log vom Malwarebyte

[spoiler]Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.19.11

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
Sven :: SVEN-NB [Administrator]

19.07.2012 18:39:31
mbam-log-2012-07-19 (18-39-31).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 395035
Laufzeit: 41 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce|0C1CFAEF0009C30C02F663A9F875EF60 (Trojan.LameShield) -> Daten: C:\ProgramData\0C1CFAEF0009C30C02F663A9F875EF60\0C1CFAEF0009C30C02F663A9F875EF60.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 3
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 1
C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 6
C:\ProgramData\0C1CFAEF0009C30C02F663A9F875EF60\0C1CFAEF0009C30C02F663A9F875EF60.exe (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\$Recycle.Bin\S-1-5-21-3281402921-3365623102-2416996113-1001\$RFNRKEE.exe (Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Sven\AppData\Local\Temp\~!#9F20.tmp (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{02bbaaef-aefc-2df4-8346-8bfe2e0b1ef6}\U\800000cb.@ (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Sven\Desktop\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)[/spoiler]


So. Nachdem das Malwaredings die Sachen gelöscht hat, habe ich noch den OTL drüber laufen lassen. Es gab aber nach em QuickScan nur eine Textdatei!?

Hier der Log:

OTL Logfile:
Code:
OTL logfile created on: 19.07.2012 20:55:47 - Run 3
OTL by OldTimer - Version 3.2.54.0    Folder = C:\Users\Sven\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 74,40% Memory free
6,00 Gb Paging File | 5,24 Gb Available in Paging File | 87,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116,44 Gb Total Space | 56,56 Gb Free Space | 48,58% Space Free | Partition Type: NTFS
Drive D: | 106,68 Gb Total Space | 32,39 Gb Free Space | 30,36% Space Free | Partition Type: NTFS
Drive F: | 3,72 Gb Total Space | 3,72 Gb Free Space | 99,82% Space Free | Partition Type: FAT32
 
Computer Name: SVEN-NB | User Name: Sven | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.19 17:33:17 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Sven\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.07.13 20:42:01 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.05.09 10:36:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Antivir\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 10:36:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Antivir\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2010.04.12 10:13:08 | 000,142,336 | ---- | M] (HP) [Auto | Stopped] -- C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe -- (HP LaserJet Service)
SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\VPN Client64\cvpnd.exe -- (CVPND)
SRV - [2009.08.18 13:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.07.01 18:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto | Stopped] -- C:\ASUS\Treiber\Bluetooth\btwdins.exe -- (btwdins)
SRV - [2009.06.15 17:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Stopped] -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.01.21 15:00:54 | 000,065,536 | ---- | M] () [Auto | Stopped] -- C:\ASUS\Treiber\Brother\bratimer.exe -- (BRA_Scheduler)
SRV - [2008.03.31 02:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Stopped] -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
SRV - [2007.08.08 00:08:40 | 000,094,208 | ---- | M] () [Auto | Stopped] -- C:\Programme\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
SRV - [2004.06.13 08:00:00 | 000,057,344 | ---- | M] (brother Industries Ltd) [Auto | Stopped] -- C:\Windows\SysWOW64\BRSVC01A.EXE -- (Brother XP spl Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.09 10:36:48 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 10:36:48 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.11 16:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.09.25 09:54:54 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.05.10 11:41:27 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011.02.21 20:59:47 | 000,230,352 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.06.30 17:17:53 | 000,035,384 | ---- | M] (ASUSTek Computer Inc) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\AsDsm.sys -- (AsDsm)
DRV:64bit: - [2010.06.30 16:28:04 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2010.06.20 22:48:27 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010.06.20 22:48:26 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.06.20 22:48:26 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.06.20 22:48:26 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.06.14 09:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.04.27 04:25:16 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV:64bit: - [2010.04.27 04:25:16 | 000,127,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV:64bit: - [2010.04.27 04:25:16 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV:64bit: - [2010.04.23 00:33:08 | 000,023,576 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hppdfaxio.sys -- (HPFXFAX)
DRV:64bit: - [2010.04.23 00:33:08 | 000,022,040 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hppdbulkio.sys -- (HPFXBULKLEDM)
DRV:64bit: - [2010.03.23 13:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV:64bit: - [2010.02.08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2009.08.21 13:59:46 | 000,716,800 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ATSwpWDF.sys -- (ATSwpWDF)
DRV:64bit: - [2009.08.18 11:44:20 | 000,236,544 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.08.17 12:15:44 | 000,286,768 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.25 17:04:20 | 000,067,584 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2009.06.25 16:38:52 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
DRV:64bit: - [2009.06.25 16:13:44 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.11.16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV:64bit: - [2007.06.16 21:28:16 | 000,217,352 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
DRV - [2011.10.01 10:30:55 | 000,137,344 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\hwpsgt.sys -- (hwpsgt)
DRV - [2011.10.01 10:30:51 | 000,009,472 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\lemsgt.sys -- (lemsgt)
DRV - [2010.06.14 09:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2007.08.03 20:26:48 | 000,017,464 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Program Files (x86)\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2007.07.24 11:11:32 | 000,014,904 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Programme\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D1 0D 2C 9B C0 65 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{965C2ECA-47BE-4852-8A71-95E81919D070}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://ecosia.org"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.7.8.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..keyword.URL: "hxxp://go.web.de/tb2/mff_keyurl_search/?su="
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Firefox\components [2012.05.21 23:33:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Firefox\plugins [2012.05.21 23:33:36 | 000,000,000 | ---D | M]
 
[2010.06.30 18:00:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Extensions
[2012.07.19 17:54:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Profiles\1q5u55c0.default\extensions
[2012.07.19 17:54:46 | 000,000,000 | ---D | M] (FoxLingo) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Profiles\1q5u55c0.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2012.05.24 09:36:37 | 000,000,933 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\1q5u55c0.default\searchplugins\11-suche.xml
[2012.05.24 09:36:37 | 000,002,419 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\1q5u55c0.default\searchplugins\englische-ergebnisse.xml
[2012.05.24 09:36:37 | 000,010,525 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\1q5u55c0.default\searchplugins\gmx-suche.xml
[2012.05.24 09:36:37 | 000,002,457 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\1q5u55c0.default\searchplugins\lastminute.xml
[2012.05.24 09:36:37 | 000,005,508 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\1q5u55c0.default\searchplugins\webde-suche.xml
[2012.06.10 20:42:00 | 000,505,801 | ---- | M] () (No name found) -- C:\USERS\SVEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\1Q5U55C0.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: []  File not found
O4:64bit: - HKLM..\Run: [HP LaserJet Professional CM1410 Series Fax] C:\Program Files\HP\HP LaserJet Professional CM1410 Series\Fax Driver\hppfaxprintersrv.exe (Hewlett-Packard Company)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ADSMTray] C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Antivir\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [StereoLinksInstall] "C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvstlink.exe" /install1 File not found
O4 - HKLM..\Run: [ToolboxFX] C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe (Hewlett-Packard Company)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk = C:\Programme\Trillian\Trillian\trillian.exe (Cerulean Studios)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\ASUS\Treiber\Bluetooth\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~3\OFFICE11\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\ASUS\Treiber\Bluetooth\btsendto_ie.htm ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\ASUS\Treiber\Bluetooth\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~3\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\ASUS\Treiber\Bluetooth\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\ASUS\Treiber\Bluetooth\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\ASUS\Treiber\Bluetooth\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\ASUS\Treiber\Bluetooth\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\ASUS\Treiber\Bluetooth\btsendto_ie.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\ASUS\Treiber\Bluetooth\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\ASUS\Treiber\Bluetooth\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x64/MuCatalogWebControl.cab?1277060454220 (MUCatalogWebControl Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab (DLM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9866EDC2-CE67-4D91-9621-259D8AAD073D}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{4f99ed3a-6fe0-11e0-955c-0023544338c3}\Shell - "" = AutoRun
O33 - MountPoints2\{4f99ed3a-6fe0-11e0-955c-0023544338c3}\Shell\AutoRun\command - "" = G:\Installer.exe
O33 - MountPoints2\{944cf111-84f0-11df-a5d5-002243a490cd}\Shell - "" = AutoRun
O33 - MountPoints2\{944cf111-84f0-11df-a5d5-002243a490cd}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.19 18:36:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2012.07.19 18:36:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.19 17:33:04 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Sven\Desktop\OTL.exe
[2012.07.19 17:16:59 | 000,937,224 | ---- | C] (Crawler.com                                                ) -- C:\Users\Sven\Desktop\SpywareTerminator30074Setup.exe
[2012.07.19 17:01:42 | 000,000,000 | ---D | C] -- C:\ProgramData\0C1CFAEF0009C30C02F663A9F875EF60
[2012.07.19 16:59:08 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012.07.14 15:06:59 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\Chromium
[2012.07.14 14:29:43 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\Ubisoft Game Launcher
[2012.07.14 14:29:39 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Might & Magic Heroes VI
[2012.07.14 14:29:39 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Might & Magic Heroes VI
[2012.07.14 14:25:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2012.06.28 19:56:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs
[2012.06.28 19:56:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
[2012.06.28 19:56:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs
[2012.06.28 19:55:51 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Software
[2012.06.28 19:55:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Software
[2012.06.28 19:55:47 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\NCH Software
[2012.06.28 19:55:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ExpressBurn
[2012.06.28 19:24:17 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\CDII
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
File not found -- C:\Windows\SysNative\
[2012.07.19 20:51:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.19 20:51:38 | 2415,218,688 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.19 18:37:10 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.19 18:15:28 | 000,000,152 | ---- | M] () -- C:\Users\Sven\defogger_reenable
[2012.07.19 18:14:41 | 000,050,477 | ---- | M] () -- C:\Users\Sven\Desktop\Defogger.exe
[2012.07.19 17:33:17 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Sven\Desktop\OTL.exe
[2012.07.19 17:17:00 | 000,937,224 | ---- | M] (Crawler.com                                                ) -- C:\Users\Sven\Desktop\SpywareTerminator30074Setup.exe
[2012.07.17 10:48:03 | 000,014,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.17 10:48:03 | 000,014,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.13 18:23:59 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.13 18:23:59 | 000,643,866 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.13 18:23:59 | 000,607,190 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.13 18:23:59 | 000,126,394 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.13 18:23:59 | 000,103,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.12 12:40:15 | 000,313,696 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.28 19:56:29 | 000,001,110 | ---- | M] () -- C:\Users\Public\Desktop\Prism Video File Converter.lnk
[2012.06.28 19:56:15 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Express Rip.lnk
[2012.06.28 19:55:53 | 000,002,086 | ---- | M] () -- C:\Users\Public\Desktop\Express Burn.lnk
[2012.06.20 14:43:18 | 000,129,065 | ---- | M] () -- C:\Users\Sven\Desktop\unterschrift Sven.pdf
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
File not found -- C:\Windows\SysNative\
[2012.07.19 18:37:10 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.19 18:15:28 | 000,000,152 | ---- | C] () -- C:\Users\Sven\defogger_reenable
[2012.07.19 18:14:40 | 000,050,477 | ---- | C] () -- C:\Users\Sven\Desktop\Defogger.exe
[2012.07.19 17:47:37 | 000,001,696 | ---- | C] () -- C:\Windows\Installer\{02bbaaef-aefc-2df4-8346-8bfe2e0b1ef6}\U\00000001.@
[2012.07.19 17:17:51 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{02bbaaef-aefc-2df4-8346-8bfe2e0b1ef6}\U\80000000.@
[2012.06.28 19:56:29 | 000,001,122 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prism Video File Converter.lnk
[2012.06.28 19:56:29 | 000,001,110 | ---- | C] () -- C:\Users\Public\Desktop\Prism Video File Converter.lnk
[2012.06.28 19:56:15 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk
[2012.06.28 19:56:15 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Express Rip.lnk
[2012.06.28 19:55:53 | 000,002,086 | ---- | C] () -- C:\Users\Public\Desktop\Express Burn.lnk
[2012.06.28 19:55:52 | 000,001,855 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn.lnk
[2012.06.20 14:36:54 | 000,129,065 | ---- | C] () -- C:\Users\Sven\Desktop\unterschrift Sven.pdf
[2012.01.13 22:19:28 | 000,000,834 | ---- | C] () -- C:\Users\Sven\.recently-used.xbel
[2012.01.12 11:17:40 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{02bbaaef-aefc-2df4-8346-8bfe2e0b1ef6}\@
[2012.01.12 11:17:40 | 000,002,048 | -HS- | C] () -- C:\Users\Sven\AppData\Local\{02bbaaef-aefc-2df4-8346-8bfe2e0b1ef6}\@
[2012.01.12 10:18:40 | 011,296,768 | ---- | C] () -- C:\Users\Sven\AppData\Roaming\Sandra.mdb
[2012.01.12 10:18:40 | 000,000,064 | ---- | C] () -- C:\Users\Sven\AppData\Roaming\Sandra.ldb
[2011.10.01 10:30:55 | 000,137,344 | ---- | C] () -- C:\Windows\SysWow64\drivers\hwpsgt.sys
[2011.10.01 10:30:51 | 000,009,472 | ---- | C] () -- C:\Windows\SysWow64\drivers\lemsgt.sys
[2011.09.02 23:06:14 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.06.22 10:45:11 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.05.20 22:35:28 | 000,304,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.02.15 18:18:44 | 000,007,610 | ---- | C] () -- C:\Users\Sven\AppData\Local\Resmon.ResmonCfg
[2011.02.12 17:42:37 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.01.18 17:11:39 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\RegisterExe.exe
[2011.01.18 17:11:37 | 000,221,184 | ---- | C] () -- C:\Windows\SysWow64\SII_PDF.dll
[2011.01.18 17:11:37 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\CSVSpecialProcessing.dll
[2011.01.18 17:11:37 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\DVM.dll
[2011.01.18 17:11:36 | 000,225,280 | ---- | C] () -- C:\Windows\SysWow64\DrakeCom.dll
[2010.12.12 19:28:21 | 000,003,584 | ---- | C] () -- C:\Users\Sven\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.01 19:36:09 | 000,005,729 | ---- | C] () -- C:\Windows\SysWow64\EPSUI64W_000.dat
[2010.06.20 22:02:01 | 000,000,673 | ---- | C] () -- C:\Users\Sven\Sven - Verknüpfung.lnk
 
========== LOP Check ==========
 
[2011.05.15 16:53:55 | 000,000,000 | -HSD | M] -- C:\Users\Sven\AppData\Roaming\.#
[2011.06.30 12:33:30 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Amazon
[2011.10.01 12:14:35 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Ankh
[2011.10.01 10:31:31 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Ascaron Entertainment
[2011.02.22 22:16:46 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Ashampoo
[2011.02.22 21:31:37 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Canneverbe Limited
[2011.04.26 11:39:27 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\DAEMON Tools Lite
[2010.07.01 18:53:43 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\elsterformular
[2011.05.26 21:24:21 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Foxit Software
[2011.05.02 20:33:39 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\GrabPro
[2012.03.08 11:34:01 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\gtk-2.0
[2010.11.10 19:14:32 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\IrfanView
[2012.05.05 21:15:48 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Kalypso Media
[2011.09.26 11:04:21 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Lionhead Studios
[2012.07.16 22:19:21 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Might & Magic Heroes VI
[2010.06.30 18:22:47 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\OpenOffice.org
[2011.05.04 18:51:26 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Orbit
[2012.01.13 21:49:04 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\PhotoScape
[2011.05.02 20:33:50 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\ProgSense
[2010.08.31 19:15:34 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Samsung
[2011.09.26 13:49:27 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\sicher_Tropico 3
[2011.01.18 17:12:15 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Softinterface, Inc
[2010.07.25 12:47:19 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Trillian
[2011.10.01 10:11:52 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Tropico 3
[2011.02.21 21:01:18 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\TrueCrypt
[2010.11.18 19:05:26 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\wwb
[2012.03.08 11:42:53 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\XnView
[2011.12.03 15:41:11 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
[/spoiler]
 

< End of report >
--- --- ---

Vielen Dank,


Takate
- ist froh, dass er vor zwei Tagen gerade den alten Desktop neu aufgesetzt hat -

markusg 20.07.2012 17:40
hi
wenn du onlinebanking machst, lasse es auf grund des zero access rootkits sperren.
alle passwörter musst du am ende endern.
da dieses rootkit gefährlich ist:
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:2. Formatieren, Windows neu instalieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

Takate 20.07.2012 19:09
Hallo Markusg,


vielen Dank für deine Hilfe. Das System neu aufsetzen ist natürlich ein Megaprojekt (das habe ich gerade vor 4 Tagen auf nem anderen PC hinter mir). Aber nun gut.

Bin aber erstmal ein paar Tage unterwegs und werde mich dann Zuhause dran setzen.

Onlinebanking läuft eh über mobile-TAN.

Trotzdem habe ich ein Problem!

a) Auf meiner externen Festplatte ist laut Malewarebytes ein schadhaftes Program: "pup.joke.geschenk"

b) Auf meinem USB-Stick ist sicherlich auch etwas drauf. Ich denke, dass ich das gesamte Problem daher habe (einmal unbedacht auf dem Lehrer-PC eingesetzt:headbang:)


Wie kann ich diese Probleme beseitigen OHNE dass ich meine Systeme wieder neu infeziere?


Danke


Takate

Takate 26.07.2012 17:14
Huhu !?!

Kann mir jemand bezüglich der Speichermedien auskunft geben?

Ich habe einen Stick mit der vermutlichen VirusQuelle (noch nicht getestet)

und

eine externe Festplatte mit einem Fund (Malewarebytes)

Was tun also?

Vielen Dank,

Takate

markusg 26.07.2012 18:12
hi
der fund von mbam ist nicht tragisch, stick formatieren wir später. sichere auf die externe platte die daten

Takate 31.07.2012 21:29
Nochmal eine Rückfrage;

Der Fund auf der Externen Festplatte ist nicht in dem obigen Log drin. Den Fund habe ich auf einem anderen PC gefunden.

Trotzdem nicht schlimm?


Danke

Takate


PS: Datensicherung geht bald los, habe aber gerade sauviel zu tun.

markusg 02.08.2012 17:13
dann poste ihn mal bitte

Takate 02.08.2012 20:43
Hallo Markus oder wer sonst (schnell) die Frage beantworten kann,


bin gerade dabei mit Parted Magic die Datensicherung durchzuführen.

Frage:

Kann ich ganze Ordner (mit Unterordnern) "rüber ziehen" oder muss ich alle Dateien einzeln mit dem Programm kopieren (das wäre ziemlich zeitaufwendig)?

Danke dir

Takate


PS: Den Log vom PC wo die externe Festplatte angeschlossen war habe ich nicht mehr. Ich habe mit Malwarebytes den Fund in die Quarantäne geschoben und seitdem zeigt Malwarebytes nix mehr an. Es war aber der (oben genannte): "pup.joke.geschenk"

Takate 04.08.2012 08:01
Huhu?! Kann mir jemand kurz die Frage mit den Ordnern beantworten? Danke! Takate

:zzwhip: hab heute Zeit zum kopieren deswegen die kleine Erinnerung :dankeschoen:

Takate 07.08.2012 21:36
Und noch eine kleine Erinnerung.....



Takate

markusg 08.08.2012 17:10
hi wenn in den ordnern nur die beschriebenen file typen sind, dann ja.

Takate 08.08.2012 20:54
Was heisst bestimmte file Typen. Es sind stinknormale Ordner mit teilweise gemischten Dateien wie z.B. Fotos, Filmen, Dokumenten, PDFs, Spielständen usw.


Danke

Takate

markusg 14.08.2012 18:49
steht doch auf seite eins, im link kritische dateiendungen! :-)


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:16 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131